Developer Tools
Branch protection rules worth turning on, and the ones to skip
Which branch protection settings add real security value on your main branch: required reviews, status checks, signed commits, and what to skip.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
How to write a blameless postmortem, with a simple template
A blameless postmortem records impact, timeline, causes and actions without blaming people. Principles and a short template based on Google's SRE guidance.
Oct 18, 20263 min read
Developer Tools
Black-box vs white-box monitoring: what each catches and misses
Black-box checks test what users see; white-box uses internal metrics and logs. Where each fits for paging, debugging and catching problems early.
Oct 18, 20263 min read
Developer Tools
bcrypt's 72 byte limit: truncation, pre-hashing and what to do
bcrypt ignores input past 72 bytes in most implementations. Why that matters, why naive pre-hashing is risky, and what OWASP suggests if you keep bcrypt.
Oct 18, 20263 min read
Developer Tools
Batch APIs for LLM work: when half price is worth the wait
Batch APIs trade speed for a lower price. See which workloads suit them, the limits to plan around, and how batching combines with prompt caching.
Oct 18, 20263 min read
Developer Tools
Backup monitoring: how to catch backups that fail silently
A green backup job does not mean a usable backup. Monitor freshness, size, completeness and restorability so silent failures show up before you need one.
Oct 18, 20263 min read
Developer Tools
What your backend proxy for LLM calls must enforce
A server in front of your LLM provider is only a security control if it enforces the right things. Seven checks every proxy should make before launch.
Oct 18, 20264 min read
Developer Tools
AUTOSAR Classic vs Adaptive: what changes for security reviews
AUTOSAR Classic suits embedded real-time units and Adaptive suits updatable high-compute systems. See the differences and what they mean for reviews.
Oct 18, 20263 min read
Developer Tools
Why you should always timestamp Windows code signatures
A Windows signature without a timestamp stops being valid when the signing certificate expires. Here is what timestamping does and how to check it.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.